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To date, the Examiner has not indicated that the subject matter of the information 
disclosure statement (IDS) filed June 7, 2006 has been properly considered. A copy of 
such IDS is submitted herewith. If the Examiner requires additional copies of any 
reference($), applicant invites the Examiner to contact the undersigned. Documentation 
in the file wrapper of the instant application confirming the Examiner's consideration of 
the reference(s) is respectfully requested. 

The Examiner has rejected Claims 2-12, 14-15, 17-27, 29-30, 32-42, and 44-51 
under 35 U.S.C. 112, second paragraph, as being indefinite for failing to particularly 
point out and distinctly claim the Subject matter which applicant regards as the invention. 
Applicant respectfully asserts that the rejection is avoided due to clarifications made to 
the claims hereinabove. 

The Examiner is thanked for the allowable subject matter of Claims 48, and 49. 
The Examiner has objected to Claims 48, and 49 as being dependent on rejected claims. 
Applicant respectfully points out that Claims 48 and 49 have been amended into 
independent form to include the lunitation of intervening dependent Claim 46, as 
suggested by the Examiner. Thus, such claims are deemed allowed. 

The Examiner has rejected Claims 1,5-8, 12-13, 15-16, 20-23, 27-28,31,35-38, 
42-43, and 50-5 1 under 35 U.S.C. 102(e) as being anticipated by Gryaznov et al. (U.S. 
Patent No. 6,748,534). Applicant respectfully disagrees with such rejection. 

With respect to independent Claims 1,16, and 3 1 , the Examiner has relied on the 
Abstract; Figures 3-4C; Col. 2, lines 43-67; and Col. 5, line 1 to Col. 7, line 42 fi-om the 
Gryaznov reference to make a prior art showing of applicant's claimed "dividmg said on- 
access malware scan into a plurality of tasks" (see this or similar, but not necessarily 
identical language in the foregoing independent claims). 
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Applicant respectfully asserts that the excerpts from Gryaznov reUed upon by the 
Examiner simply teach that "[t]he header for the next news message 42 to be scanned is 
retrieved (block 104) by looking up the last read article number from the last read table 
68 (shown in FIG. 3) for that newsgroup 43 and that news server 58, 59, 60" and "[o]nly 
news messages 42 which have vet been read nor have evpired are scanned" (see Col. 7. 
lines 1 -7-emphasis added). However, the mere disclosure by Gryaznov that the last read 
article number from the last read table is retrieved and only news messages that have not 
been read and are not expired are scanned simply fails to even suggest "dividing said ofc 
access malware scan into a pluralitv of tasks" (emphasis added), as claimed by applicant. 
Clearly, scanning news messages that have not been read and are not expired, as in 
Gryaznov, fails to even suggest an "on-access malware scan," as claimed by apphcant. 

Further, with respect to independent Claims 1, 16. and 3 1, the Exammer has again 
relied on the Abstract; Figures 3-4C; Col. 2, lines 43-67; and Col. 5, line 1 to Col. 7, line 
42 from the Gryaznov reference to make a prior art showing of applicant's claimed 
"issuing said plurality of tasks to be performed by a plurality of different computers" (see 
this or similar, but not necessarily identical language in the foregoing independent 
claims). 

Applicant respectfully asserts that the excerpts in Gryaznov relied upon by the 
Examiner merely teach that "[t]he threads table 67 maintained in the centralized database 
65 (shown in FIG. 3) is accessed to determine whether the current fi le thread is locked 
from access bv other virus scanners 54. 55. 56" (see Col. 7, lines 1 8-22-emphasis added). 
In addition, Gryaznov teaches that "[i]f the file thread is locked (block 110), another 
thread is selected (block 1 09)" and "(ijf the file thread is available, the file thread is 
locked (block 1 1 1) by adding an entry to the threads table 67" (see Col. 7, lines 22-25- 
emphasis added), Clearly, the mere disclosure that a virus scanner determines if the 
current file thread is locked from access and locks the thread if it is available, as m 
Gryaznov, fails to even suggest " issuing said pluralitv of tasks to be performed by a 
plurality of different computers" (emphasis added), as claimed by applicant. 
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In addition, with respect to independent Claims 1,16, and 3 1, the Examiner has 
relied on the Abstract; Figures 3-4C; Col. % lines 43-67; and Col 5, line 1 to Col. 7, line 
42 from the Gryaznov reference to make a prior art showing of applicant's claimed 
"collating a plurality of task results corresponding to said plurality of tasks and received 
from said plurality of different computers to form a scan result corresponding to said on- 
access malware scan." (see this or similar, but not necessarily identical language in the 
foregoing independent claims - as amended). 

Applicant respectfully asserts that the excerpts from Gryaznov relied upon by the 
Examiner merely teach that "[i]f any of the downloaded files are infected (block 1 17), a 
warning message is generated (block 118)" and that "each virus scanner 54, 55, 56 
maintains a log file and posts an appropriate warning to the affected newsgroups 43" (see 
Col. 7, lines 37-42-emphasis added). However, the simply disclosing generating a 
warning message if any downloaded files are infected, maintaining a log file, and posting 
a warning to affected newsgroups, as in Gryaznov, simply fails to even suggest 
"collating a plurality of task tesults," let alone where such task results "[correspond] to 
said plurality of tasks and [are] received from said plurality of different computers [and 
are collated] to form a scan result corresponding to said on-access malware scan" 
(emphasis added), as claimed by applicant. 

Fiirther, with respect to independent Claims 1 3, 28, and 43, the Examiner has 
relied on the Abstract; Figures 3-4C; Col. 2, lines 43-67; and Col. 5, line 1 to CoL 7, line 
42 from the Gryaznov reference to malce a prior art showing of applicant's claimed 
technique "wherein said malware scanning task is one of a plurality of malware scatming 
tasks that are each part of said on-access malware scan" (see this or similar, but not 
necessarily identical language in the foregoing independent claims). 

Applicant respectfully asserts that the excerpts from Gryaznov relied upon by the 
Examiner simply teach that ''[ejach of the virus scanners 54, 55, 56 operate 
independently of each other and therefore create the potential for multiple virus scanners 
54, 55, 56 attempting to scan different parts of the same multi-part news message " (see 
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CoL 6, lines 25-29-emphasis added). However, the mere disclosxire that vbus scanners 
operate independently of each other and may attempt to scan different parts of the same 
multi-part news message, as in Gryaznov, fails to even suggest a technique "wherein said 
malware scanning task is one of a plurality of malware scanning tasks that are each part 
of said on-access malware scan " (emphasis added), as claimed by applicant. 

In addition, with respect to independent Claims 13, 28, and 43, the Examiner has 
relied on the Abstract; Figures 3-4C; Col 2, lines 43-67; and Col 5, line 1 to Col. 7, line 
42 from the Gryaznov reference to make a prior art showing of applicant's claimed 
technique "wherein a plurality of malware scannmg task results corresponding to said 
plurality of malware scanning tasks are collated to form a scan result corresponding to 
said on-access malware scan" (see this or similar, but not necessarily identical language 
in the foregoing independent claims). 

Applicant respectfully asserts that the excerpts from Gryaznov relied upon by the 
Examiner merely teach that "pjf any of the downloaded files are infected (block 1 17), a 
warning message is generated (block 1 1 8)'* and that ''each virus scanner 54, 55, 56 
maintains a log file and posts an appropriate waroinR to the affected newsgroups 43'* 
(emphasis added). However, the mere disclosure of generating a warning message if any 
of the downloaded files are infected, maintaining a log file, and posting a warning to the 
affected newsgroups, as in Gryaznov, simply fails to even suggest a technique 'Svherein a 
plurality of malware s canning t ask results corresponding to said plurality of malware 
scanning tasks are collated to form a scan result corresponding to said on-access malware 
scan" (emphasis added), as claimed by applicant. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros. v. Union Oil Co. Of California, 814 F,2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained m the claim. Richardson v, Suzuki Motor 
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Co. 868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the above reference, as noted above. 
Thus, a notice of allowance or a proper prior art showing of each of the foregoing 
claimed features is respectfully requested. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to Claim 10 et al., the Examiner has 
rejected the same under 35 U.S.C. 103(a) as being unpatentable over Gryaznov in view of 
Gartside (U.S. Patent No. 6,851,058). Specifically, the Examiner has relied on CoL 6, 
lines 17-65 from the Gartside reference to make a prior art showing of applicant's 
claimed technique "wherein said on-access malware scan is not further divided if said on- 
access malware scan is detected as having a complexity below a predeteimined threshold 
level" (as amended). 

Applicant respectfully asserts that the excerpt from Gartside relied upon by the 
Examiner merely teaches that "[i]f the tests 304, 320, 322, 324 indicate the archive does 
not contain sub-archives, does not have an excessive de-compressed size, does not 
contain a large number of files, and does not have too many file types, then the archive is 
considered to be safe, and it is set 326 to with a normal scanning priority" (emphasis 
added). Clearly, the mere disclosure that an archive without sub-archives, an excessive 
de-compressed size, a large number of files, and too many file types is considered to be 
safe and set with a normal scanning priority, as in Gartside. fails to even suggest an "on- 
access malware scan [that] is not further divided," as appellant claims, let alone a specific 
technique "wherein said on-access malware scan is not fiuther divided if said on-access 
malware scan is detected as having a complexity below a oredetenmned threshold level " 
(emphasis added), as claimed by applicant 

To establish a prima facie case of obviousness, three basic criteria must be met. 
Fkst, there must be some suggestion or motivation, cither in the references themselves or 
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in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
clauned combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck947 F2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 

Applicant respectfully asserts that at least the third element of ihc prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Thus, a notice of 
allowance or specific prior art showing of each of the foregoing claim elements, in 
combination with the remaining claimed features, is respectfully requested. 

To this end, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5 1 00, The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P466/0 1.042.01). 

Respept&Hy submitfed, 

P.O. Box 721120 
San Jose, CA 95172-1120 
408-505-5100 




I Zilka 
igistrationNo. 41,429 
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